Study App Series Privacy Policy
This privacy policy describes how information is handled in the Study App Series (the "App"), a study app for certification and licensing exams available on iOS, Android, and macOS.
Summary: the App does not require account registration. Data such as your learning history and progress is stored on your device, and we do not independently collect it. The App sends minimal information to a server we operate when you purchase, restore, or recheck purchase status. We do not use tracking for advertising or analytics.
1. Operator
The App is provided by Legiotech, LLC ("we").
Address: Shiba, Minato-ku, Tokyo, Japan
For inquiries, see the "Contact" section below.
2. Our Approach
The App does not require account registration, and we do not collect information that directly identifies you, such as your name or email address, through normal use of the App.
However, if you use the contact form described below, we collect the name, email address, and other information you enter into that form. Please note that the scope of information collected differs between normal use of the App and use of the contact form. See the "Contact" section below for details.
3. Information Stored on Your Device
Your learning history, spaced-repetition (FSRS) progress, answer records, and settings are all stored on your device. None of this information is sent to our servers. Free learning access is defined by deck, rather than by a cumulative answer allowance.
The export feature lets you save your learning history, spaced-repetition (FSRS) progress, settings, any paused session, and bookmarks to a file at your own discretion. Your purchase status is not included in the export.
Data stored on your device may also be subject to OS-level backup mechanisms, such as Android's automatic backup feature or iOS's iCloud/iTunes backup, or macOS Time Machine. Whether data is sent to our servers and whether it is subject to an OS backup feature are two separate matters, and we ask that you keep both in mind.
4. Information Sent When You Purchase
When you purchase, restore, or recheck purchase status, we send the following information to our receipt verification server (receipt-verify.svc.legiotech.jp, a general-purpose server we operate on Google Cloud Platform's Cloud Run and share across our apps) in order to verify your purchase.
The Bundle ID is sent in all cases. On iOS and macOS, we additionally send the signed transaction information issued by Apple (in JWS format, which carries a digital signature for tamper detection and is not itself encrypted; it includes the transaction ID, product ID, and purchase date). On Android, we additionally send the purchase token and product ID issued by Google Play.
When rechecking purchase status, the App may also send signed entitlement information issued by us. Your Apple ID or Google Account itself, your name, and your email address are never sent.
5. Information We Store on Our Server
On our server, we store in Firestore (a Google Cloud database) only the information needed to verify the validity of your purchase and to activate or restore paid features.
The items we store are: the app's Bundle ID, an identifier for the purchase (such as a transaction ID), the product ID, an environment classification (production or sandbox) and purchase platform, an entitlement classification based on whether a record already exists on our server, the transaction type, a validity flag, and related timestamps (such as the purchase date, last update time, and expiration time).
For Android purchases, we also store the purchase token needed to recheck purchase status, an order ID when provided, purchase and acknowledgement states, test or other purchase classifications, and purchase region. If an app sends an app account token, that identifier is also stored.
This classification does not record whether you performed a purchase or a restore action. If you restore a purchase after its server record has been deleted, it is classified as an initial grant because no existing record is present.
We use this information solely to provide and restore paid features.
6. Access Logs and IP Addresses
We process and log IP addresses, access times, request destinations, response status, processing times, and diagnostic information such as errors to prevent unauthorized use and operate the service reliably.
Our receipt verification server is designed to keep receipt contents, purchase tokens, and authorization credentials out of logs, and also masks the designated sensitive fields.
7. Purpose of Use
We use the information we collect solely for the following purposes.
- Providing and restoring paid features
- Preventing unauthorized use
- Operating the service reliably
- Responding to your inquiries
8. Provision to Third Parties
We provide or entrust information only to the following recipients, and only to the extent necessary. We do not provide or sell information for advertising purposes.
We handle entrusted information under contractual purpose limitations, confidentiality, security, and subcontracting requirements to ensure protection equivalent to this policy. Our infrastructure provider, Google Cloud, is bound by the Cloud Data Processing Addendum, including processing instructions, confidentiality, security measures, and written agreements with subprocessors. Apple and Google Play also handle store operations and purchase information under their respective terms and privacy policies.
- Apple Inc.: to verify the validity of purchase proofs (signed transaction information) on iOS and macOS
- Google LLC: to verify the validity of purchase tokens on Android
- Google Cloud Platform (Google LLC): to provide our server infrastructure (database, runtime environment, and so on)
9. International Transfer
Our servers may operate on Google Cloud Platform, including locations outside Japan.
10. Analytics, Advertising, and Tracking
The App does not use advertising identifiers (IDFA / AAID) and does not track your behavior for advertising purposes.
The App includes no analytics SDK and no crash-reporting SDK.
11. Device Permissions
The App may use the following device permissions. Each is used only based on your own action or consent.
- Notifications: to show review reminders
- File access: to export and import your learning data
- Vibration: to provide feedback during study sessions
12. Retention
We retain purchase-related information on our server for as long as needed to provide and restore paid features. To support restoration of one-time purchases, these records are not configured for automatic deletion after a fixed number of days.
Disaster-recovery backups of purchase-related information are created daily, retained for 90 days from creation, and then become eligible for automatic deletion. Deletion processing may take additional time. Ordinary access and application logs are retained for 30 days, and required infrastructure audit logs for 400 days.
You can erase local learning data using "Reset Learning." Depending on the OS and removal method, app data folders, secure storage holding purchase status, backups, and exported files may remain after uninstalling the App. Remove these separately using the relevant OS controls or file management tools. Uninstalling or resetting learning does not delete store purchase records or purchase-related information on our server.
13. Your Rights and Deletion Requests
Using "Reset Learning" in the App clears your learning history, progress, and bookmarks. Paused study sessions are also cleared, while your settings and Pro purchase status are retained. In apps with grade selection, the reset applies to the selected grade. See "Retention" for deletion of device data.
If you would like us to disclose or delete the purchase-related information stored on our server, please contact us. Please note that your purchase itself remains recorded with the App Store or Google Play, so if you use the App's "Restore Purchases" feature after deletion, re-verifying your purchase will recreate the corresponding information on our server.
14. Children's Privacy
We do not knowingly collect personal information from children.
15. Changes to This Policy
If we change the contents of this policy, we will announce the change by updating this page. The revised policy takes effect once it is posted on this page.
16. Contact
For inquiries about this policy, please contact us at the email address below.
You can also reach us through our online contact form. The form asks for your name, email address, subject, and message. The service your inquiry relates to, your display language, and the time of receipt are also recorded automatically. The information you provide is used solely to respond to your inquiry and is sent to our configured delivery destination. If no destination is configured, or if delivery fails, the information is recorded in server-side logs so our staff can review and respond (even in that case, the information is never used for any purpose other than responding to your inquiry). When recorded in logs, the message body is truncated to its first 500 characters.
17. Revision History
September 9, 2026: Established.
September 22, 2026: Clarified supported operating systems, FSRS, free decks, purchases and resets, retention, and protections for entrusted data.
If we change the contents of this policy, we will announce the change by updating this page.